canglan 559970c5b7 feat: one account can bind both netease + skin identities ...

- db: user_identities table (UNIQUE user_id+source), migrate backfill from users
- auth: GET/POST/DELETE /api/auth/identities - bind/unbind/list identities
  (netease requires UID, one per source, name uniqueness, keep >=1)
- register/external/plugin/admin-created users auto-write primary identity
- tickets: submit uses selected identity (validated belongs to user)
- dashboard: 我的身份 card with bind/unbind UI
- ticket-create: identity selector when >1 identity

2026-08-17 01:17:09 +08:00

..

middleware

fix: api key cache invalidated by config mtime - server picks up new key after reinstall

2026-08-16 23:03:03 +08:00

routes

feat: one account can bind both netease + skin identities

2026-08-17 01:17:09 +08:00

db.js

feat: one account can bind both netease + skin identities

2026-08-17 01:17:09 +08:00

mailer.js

fix: HIGH+MEDIUM bugs from full audit - listen error, JWT, upload, mailer, webhook

2026-07-13 03:49:02 +08:00

server.js

fix: async route rejection crashes process - global async error wrap + email dup check

2026-08-17 01:03:45 +08:00

webhook.js

security: timing-safe API key, SSRF webhook guard, API no-cache, Referrer-Policy

2026-07-13 19:49:44 +08:00